CVE-2021-3750: Use After Free
First published: Mon Aug 30 2021(Updated: )
A DMA reentrancy issue was found in the EHCI controller emulation of QEMU. From <a href="https://gitlab.com/qemu-project/qemu/-/issues/541">https://gitlab.com/qemu-project/qemu/-/issues/541</a>: """ When EHCI tries to transfer the USB packets, it doesn't check if the Buffer Pointer is overlapped with its MMIO region. So crafted content may be written to the controller's registers and trigger actions like reset, but the device is still transferring packets. """ This flaw could enable a malicious guest to crash QEMU, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. For more information (stack trace, reproducer) see the aforementioned upstream issue.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| QEMU qemu | <7.0.0 | |
| Redhat Enterprise Linux | =8.0 | |
| Redhat Enterprise Linux | =8.0 | |
| ubuntu/qemu | <1:2.11+dfsg-1ubuntu7.41 | 1:2.11+dfsg-1ubuntu7.41 |
| ubuntu/qemu | <1:4.2-3ubuntu6.24 | 1:4.2-3ubuntu6.24 |
| ubuntu/qemu | <1:7.0+dfsg-7ubuntu1 | 1:7.0+dfsg-7ubuntu1 |
| ubuntu/qemu | <1:6.2+dfsg-2ubuntu6.6 | 1:6.2+dfsg-2ubuntu6.6 |
| debian/qemu | <=1:3.1+dfsg-8+deb10u8<=1:3.1+dfsg-8+deb10u11<=1:5.2+dfsg-11+deb11u3<=1:5.2+dfsg-11+deb11u2 | 1:7.2+dfsg-7+deb12u3 1:8.2.1+ds-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1999073
- https://gitlab.com/qemu-project/qemu/-/issues/541
- https://gitlab.com/qemu-project/qemu/-/issues/556
- https://security.gentoo.org/glsa/202208-27
- https://security.netapp.com/advisory/ntap-20220624-0003/
- https://launchpad.net/bugs/cve/CVE-2021-3750
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3750
- https://ubuntu.com/security/notices/USN-5772-1
- https://nvd.nist.gov/vuln/detail/CVE-2021-3750
- https://security-tracker.debian.org/tracker/CVE-2021-3750
- https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg03692.html
- https://lists.nongnu.org/archive/html/qemu-devel/2021-12/msg02356.html (newer)
- https://git.qemu.org/?p=qemu.git;a=commit;h=b9d383ab797f54ae5fa8746117770709921dc529 (1/3)
- https://git.qemu.org/?p=qemu.git;a=commit;h=58e74682baf4e1ad26b064d8c02e5bc99c75c5d9 (2/3)
- https://git.qemu.org/?p=qemu.git;a=commit;h=3ab6fdc91b72e156da22848f0003ff4225690ced (3/3)
- https://gitlab.com/qemu-project/qemu/-/commit/3ab6fdc9
- https://ubuntu.com/security/CVE-2021-3750
- https://lists.nongnu.org/archive/html/qemu-devel/2021-12/msg02356.html
- https://gitlab.com/qemu-project/qemu/-/commit/b9d383ab797f54ae5fa8746117770709921dc529
- https://gitlab.com/qemu-project/qemu/-/commit/58e74682baf4e1ad26b064d8c02e5bc99c75c5d9
- https://gitlab.com/qemu-project/qemu/-/commit/3ab6fdc91b72e156da22848f0003ff4225690ced
- https://gitlab.com/qemu-project/qemu/-/issues/541#note_1179940468
- https://gitlab.com/qemu-project/qemu/-/commit/a2e1753b8054344f32cf94f31c6399a58794a380
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1999235
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1999234
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1999073#c0
- https://access.redhat.com/solutions/408653
- https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg03927.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1999073#c2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1999073#c8
- https://access.redhat.com/errata/RHSA-2022:7967
- https://access.redhat.com/security/cve/cve-2021-3750
- https://access.redhat.com/errata/RHSA-2023:6980
- https://access.redhat.com/errata/RHSA-2024:0404
- https://access.redhat.com/errata/RHSA-2024:0569
Frequently Asked Questions
What is CVE-2021-3750?
CVE-2021-3750 is a vulnerability in the USB EHCI controller emulation of QEMU that allows crafted content to be written to the controller's registers and trigger undesirable actions.
What is the severity of CVE-2021-3750?
CVE-2021-3750 has a severity rating of 8.2 out of 10.
How does CVE-2021-3750 affect QEMU?
CVE-2021-3750 affects QEMU's USB EHCI controller emulation.
How can I fix CVE-2021-3750?
To fix CVE-2021-3750, update QEMU to version 7.0.0 or later.
Where can I find more information about CVE-2021-3750?
More information about CVE-2021-3750 can be found at the following references: [link1](https://gitlab.com/qemu-project/qemu/-/issues/541), [link2](https://gitlab.com/qemu-project/qemu/-/issues/556), [link3](https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg03692.html).
- collector/nvd-index
- agent/type
- agent/remedy
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/severity
- collector/usn-cve
- source/Ubuntu
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- agent/event
- agent/description
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-3750
- vendor/qemu
- canonical/qemu qemu
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- package-manager/ubuntu
- package-manager/debian